Read the docs
TI-2026-81524 Aliases CVE-2026-112352GHSA-rvgw-426x-67hr

Authentication bypass in Sunhillo SureLine via forged session cookie

Priority MEDIUM 44CWE-565Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Sunhillo SureLine from 8.0.0 before 9.1.5 contains an authentication bypass. A flaw in how the product trusts session cookies lets an unauthenticated remote attacker impersonate any user with an active web session by forging a cookie that contains only a cleartext username. Default account names such as Admin or sftp_user can be guessed, and the forged cookie satisfies the login check in checkLogin, chaining into root command execution. CWE-565 applies.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection. Attackers can guess default account names such as Admin or sftp_user and submit a forged username cookie to satisfy the login check in checkLogin (libwebcmn.so) and networkDiag.cgi, chaining into root command execution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01457 73rd percentileScored 2026-11-07
Fix Fixed SureLine (Sunhillo Corporation): 9.1.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SunhilloSureLine8.0.0 to before 9.1.59.1.5Patch availableCNA
  • SureLine VendorSunhillo Affected 8.0.0 to before 9.1.5 Fixed in 9.1.5 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sunhillo:sureline:*:*:*:*:*:*:*:*8.0.0 to before 9.1.5VulnerableSunhillo
  • cpe:2.3:a:sunhillo:sureline:*:*:*:*:*:*:*:* Versions 8.0.0 to before 9.1.5 Vulnerable ·Sunhillo

Remediation

Upgrade Sunhillo SureLine to version 9.1.5 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA SureLine (Sunhillo Corporation) Fixed in 9.1.5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Sunhillo SureLine 9.1.5

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2026-81519 OS command injection in Sunhillo SureLine via networkDiag.cgiPriority MEDIUM 45
    • TI-2026-81518 Path traversal in Sunhillo SureLine lets attackers read arbitrary filesPriority MEDIUM 45
    Show all 3 records →

Timeline

  1. 2026-10-27 Threatist record created from CVE-2026-112352
  2. 2026-10-27 Alias added: GHSA-rvgw-426x-67hr
  3. 2026-10-28 CISA SSVC decision points changed
  4. 2026-10-28 Priority changed: MEDIUM → LOW
  5. 2026-10-28 Priority changed: LOW → MEDIUM
  6. 2026-11-03 CVSS score added · NVD

References

Other 1

  • TI-2021-14731 Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell… KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-81519 OS command injection in Sunhillo SureLine via networkDiag.cgi CVSS 4.0HIGH 8.7
  • TI-2026-81518 Path traversal in Sunhillo SureLine lets attackers read arbitrary files CVSS 4.0HIGH 8.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences